API tools faq
paste
Advertisement
Guest User

EM13c TLS Check Script v0.8

a guest
Sep 14th, 2016
147
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 34.27 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. #
  3. # This script should examine your EM13c environment, identify the ports
  4. # each component uses, and check for SSLv2/SSLv3 usage, as well as make
  5. # sure that weak cipher suites get rejected.  It will also validate your
  6. # system comparing against the latest recommended patches and also flags
  7. # the use of demo or self-signed certificates.  Latest enhancement adds
  8. # checks for the EM13c WLS Java JDK version.
  9. #
  10. # Released  v0.1:  Initial beta release 5 Apr 2016
  11. # Changes   v0.2:  Updated for current patches
  12. # Changes   v0.3:  APR2016 patchset added
  13. # Changes   v0.4:  Plugin updates for 20160429
  14. # Changes   v0.5:  Plugin updates for 20160531
  15. # Changes   v0.6:  Plugin/OMS/DB updates for 20160719 CPU + Java check
  16. # Changes   v0.7:  Plugin/OMS updates for 20160816 bundles
  17. #                  Support for SLES11 OpenSSL 1 parallel package
  18. #                  Add checks for TLSv1.1, TLSv1.2
  19. #                  Permit only TLSv1.2 where supported by OpenSSL
  20. # Changes   v0.8:  Fix broken check for SSL_CIPHER_SUITES
  21. #                  Add checks for ENCRYPTION_SERVER, ENCRYPTION_CLIENT,
  22. #                  CRYPTO_CHECKSUM_SERVER, CRYPTO_CHECKSUM_CLIENT,
  23. #                  ENCRYPTION_TYPES_SERVER, ENCRYPTION_TYPES_CLIENT,
  24. #                  CRYPTO_CHECKSUM_TYPES_SERVER, CRYPTO_CHECKSUM_TYPES_CLIENT
  25. #
  26. # From: @BrianPardy on Twitter
  27. #
  28. # Known functional on Linux x86-64, may work on Solaris and AIX.
  29. #
  30. # Run this script as the Oracle EM13c software owner, with your environment
  31. # fully up and running.
  32. #
  33. # Thanks to Dave Corsar, who tested a previous version on Solaris and
  34. # let me know the changes needed to make the script work on Solaris.
  35. #
  36. # Thanks to opa tropa who confirmed AIX functionality on a previous
  37. # version and noted the use of GNU extensions to grep, which I have
  38. # since removed.
  39. #
  40. # Thanks to Paige, who informed me of a broken check for the
  41. # SSL_CIPHER_SUITES parameter that led me to add the additional checks
  42. # for SQL*Net encryption
  43. #
  44. # In order to check selections for ENCRYPTION_TYPES and CRYPTO_CHECKSUM_TYPES
  45. # I have to make some judgement calls. Due to MD5's known issues, I consider
  46. # it unacceptable for CRYPTO_CHECKSUM_TYPES. Unfortunately SHA256, the
  47. # best choice available, can cause problems with target promotion in OEM
  48. # (see MOS note 2167682.1) so this check will simply make sure you do not
  49. # permit MD5, but will not enforce SHA256. This same issue also requires
  50. # allowing 3DES168 as an encryption algorithm to promote targets, though
  51. # I would generally not allow 3DES168 for security reasons. This check
  52. # will simply make sure you do not permit DES, DES40, 3DES112, or any
  53. # of the RC4_* algorithms.
  54. #
  55. #
  56. # Dedicated to our two Lhasa Apsos:
  57. #   Lucy (6/13/1998 - 3/13/2015)
  58. #   Ethel (6/13/1998 - 7/31/2015)
  59. #
  60.  
  61. SCRIPTNAME=`basename $0`
  62. PATCHDATE="16 Aug 2016"
  63. OMSHOST=`hostname -f`
  64. VERSION="0.8"
  65. FAIL_COUNT=0
  66. FAIL_TESTS=""
  67.  
  68. RUN_DB_CHECK=0
  69. VERBOSE_CHECKSEC=2
  70.  
  71. HOST_OS=`uname -s`
  72. HOST_ARCH=`uname -m`
  73.  
  74. ORAGCHOMELIST="/etc/oragchomelist"
  75. ORATAB="/etc/oratab"
  76. OPENSSL=`which openssl`
  77.  
  78. if [[ -x "/usr/bin/openssl1" && -f "/etc/SuSE-release" ]]; then
  79.     OPENSSL=`which openssl1`
  80. fi
  81.  
  82. if [[ ! -r $ORAGCHOMELIST ]]; then          # Solaris
  83.     ORAGCHOMELIST="/var/opt/oracle/oragchomelist"
  84. fi
  85.  
  86. if [[ ! -r $ORATAB ]]; then                 # Solaris
  87.     ORATAB="/var/opt/oracle/oratab"
  88. fi
  89.  
  90. if [[ -x "/usr/sfw/bin/gegrep" ]]; then
  91.     GREP=/usr/sfw/bin/gegrep
  92. else
  93.     GREP=`which grep`
  94. fi
  95.  
  96. OPENSSL_HAS_TLS1_1=`$OPENSSL s_client help 2>&1 | $GREP -c tls1_1`
  97. OPENSSL_HAS_TLS1_2=`$OPENSSL s_client help 2>&1 | $GREP -c tls1_2`
  98. OPENSSL_ALLOW_TLS1_2_ONLY=$OPENSSL_HAS_TLS1_2
  99.  
  100. OPENSSL_PERMIT_FORBID_NON_TLS1_2="Permit"
  101.  
  102. if [[ $OPENSSL_ALLOW_TLS1_2_ONLY -gt 0 ]]; then
  103.     OPENSSL_PERMIT_FORBID_NON_TLS1_2="Forbid"
  104. fi
  105.  
  106.  
  107.  
  108. OMS_HOME=`$GREP -i oms $ORAGCHOMELIST | xargs ls -d 2>/dev/null`
  109.  
  110. if [[ "$OMS_HOME" == "." ]]; then
  111.     OMS_HOME=`cat $ORAGCHOMELIST | head -n 1`
  112. fi
  113.  
  114.  
  115. OPATCH="$OMS_HOME/OPatch/opatch"
  116. OPATCHAUTO="$OMS_HOME/OPatch/opatchauto"
  117. OMSPATCHER="$OMS_HOME/OMSPatcher/omspatcher"
  118. OMSORAINST="$OMS_HOME/oraInst.loc"
  119. ORAINVENTORY=`$GREP inventory_loc $OMSORAINST | awk -F= '{print $2}'`
  120.  
  121. MW_HOME=$OMS_HOME
  122. COMMON_HOME="$MW_HOME/oracle_common"
  123.  
  124. AGENT_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"agent13c" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  125.  
  126.  
  127. EM_INSTANCE_BASE=`$GREP GCDomain $MW_HOME/domain-registry.xml | sed -e 's/.*=//' | sed -e 's/\/user_projects.*$//' | sed -e 's/"//'`
  128.  
  129. EMGC_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/emgc.properties"
  130. EMBIP_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/embip.properties"
  131. #OPMN_PROPS="$EM_INSTANCE_BASE/WebTierIH1/config/OPMN/opmn/ports.prop"
  132. #OHS_ADMIN_CONF="$EM_INSTANCE_BASE/WebTierIH1/config/OHS/ohs1/admin.conf"
  133.  
  134. PORT_UPL=`$GREP EM_UPLOAD_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  135. PORT_OMS=`$GREP EM_CONSOLE_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  136. PORT_OMS_JAVA=`$GREP MS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  137. PORT_NODEMANAGER=`$GREP EM_NODEMGR_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  138. PORT_BIP=`$GREP BIP_HTTPS_PORT $EMBIP_PROPS | awk -F= '{print $2}'`
  139. PORT_BIP_OHS=`$GREP BIP_HTTPS_OHS_PORT $EMBIP_PROPS | awk -F= '{print $2}'`
  140. PORT_ADMINSERVER=`$GREP AS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  141. #PORT_OPMN=`$GREP '/opmn/remote_port' $OPMN_PROPS | awk -F= '{print $2}'`
  142. #PORT_OHS_ADMIN=`$GREP Listen $OHS_ADMIN_CONF | awk '{print $2}'`
  143. PORT_AGENT=`$AGENT_HOME/bin/emctl status agent | $GREP 'Agent URL' | sed -e 's/\/emd\/main\///' | sed -e 's/^.*://' | uniq`
  144.  
  145. REPOS_DB_CONNDESC=`$GREP EM_REPOS_CONNECTDESCRIPTOR $EMGC_PROPS | sed -e 's/EM_REPOS_CONNECTDESCRIPTOR=//' | sed -e 's/\\\\//g'`
  146. REPOS_DB_HOST=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*HOST=//' | sed -e 's/).*$//'`
  147. REPOS_DB_SID=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*SID=//' | sed -e 's/).*$//'`
  148.  
  149. if [[ "$REPOS_DB_HOST" == "$OMSHOST" ]]; then
  150.     REPOS_DB_HOME=`$GREP "$REPOS_DB_SID:" $ORATAB | awk -F: '{print $2}'`
  151.     REPOS_DB_VERSION=`$REPOS_DB_HOME/OPatch/opatch lsinventory -oh $REPOS_DB_HOME | $GREP 'Oracle Database' | awk '{print $4}'`
  152.  
  153.     if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  154.         RUN_DB_CHECK=1
  155.     fi
  156.  
  157.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  158.         RUN_DB_CHECK=1
  159.     fi
  160.  
  161.     if [[ "$RUN_DB_CHECK" -eq 0 ]]; then
  162.         echo -e "\tSkipping local repository DB patch check, only 11.2.0.4 or 12.1.0.2 supported by this script for now"
  163.     fi
  164. fi
  165.  
  166.  
  167.  
  168. sslcheck () {
  169.     OPENSSL_CHECK_COMPONENT=$1
  170.     OPENSSL_CHECK_HOST=$2
  171.     OPENSSL_CHECK_PORT=$3
  172.     OPENSSL_CHECK_PROTO=$4
  173.     OPENSSL_AVAILABLE_OR_DISABLED="disabled"
  174.  
  175.     if [[ $OPENSSL_CHECK_PROTO == "tls1_1" && $OPENSSL_HAS_TLS1_1 == 0 ]]; then
  176.         echo -en "\tYour OpenSSL ($OPENSSL) does not support $OPENSSL_CHECK_PROTO. Skipping $OPENSSL_CHECK_COMPONENT\n"
  177.         return
  178.     fi
  179.  
  180.     if [[ $OPENSSL_CHECK_PROTO == "tls1_2" && $OPENSSL_HAS_TLS1_2 == 0 ]]; then
  181.         echo -en "\tYour OpenSSL ($OPENSSL) does not support $OPENSSL_CHECK_PROTO. Skipping $OPENSSL_CHECK_COMPONENT\n"
  182.         return
  183.     fi
  184.  
  185.  
  186.     OPENSSL_RETURN=`echo Q | $OPENSSL s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -$OPENSSL_CHECK_PROTO 2>&1 | $GREP Cipher | $GREP -c 0000`
  187.    
  188.  
  189.     if [[ $OPENSSL_CHECK_PROTO == "tls1" || $OPENSSL_CHECK_PROTO == "tls1_1" || $OPENSSL_CHECK_PROTO == "tls1_2" ]]; then
  190.  
  191.         if [[ $OPENSSL_ALLOW_TLS1_2_ONLY > 0 ]]; then
  192.             if [[ $OPENSSL_CHECK_PROTO == "tls1_2" ]]; then
  193.                 OPENSSL_AVAILABLE_OR_DISABLED="available"
  194.             fi
  195.         fi
  196.  
  197.         if [[ $OPENSSL_ALLOW_TLS1_2_ONLY == 0 ]]; then
  198.             OPENSSL_AVAILABLE_OR_DISABLED="available"
  199.         fi
  200.  
  201.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO $OPENSSL_AVAILABLE_OR_DISABLED for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  202.  
  203.         if [[ $OPENSSL_AVAILABLE_OR_DISABLED == "available" ]]; then
  204.             if [[ $OPENSSL_RETURN -eq "0" ]]; then
  205.                 echo OK
  206.             else
  207.                 echo FAILED
  208.                 FAIL_COUNT=$((FAIL_COUNT+1))
  209.                 FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection failed"
  210.             fi
  211.         fi
  212.  
  213.         if [[ $OPENSSL_AVAILABLE_OR_DISABLED == "disabled" ]]; then
  214.             if [[ $OPENSSL_RETURN -ne "0" ]]; then
  215.                 echo OK
  216.             else
  217.                 echo FAILED
  218.                 FAIL_COUNT=$((FAIL_COUNT+1))
  219.                 FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection allowed"
  220.             fi
  221.         fi
  222.  
  223.  
  224.     fi
  225.  
  226.     if [[ $OPENSSL_CHECK_PROTO == "ssl2" || $OPENSSL_CHECK_PROTO == "ssl3" ]]; then
  227.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO $OPENSSL_AVAILABLE_OR_DISABLED for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  228.         if [[ $OPENSSL_RETURN -ne "0" ]]; then
  229.             echo OK
  230.         else
  231.             echo FAILED
  232.             FAIL_COUNT=$((FAIL_COUNT+1))
  233.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection succeeded"
  234.         fi
  235.     fi
  236. }
  237.  
  238. opatchcheck () {
  239.     OPATCH_CHECK_COMPONENT=$1
  240.     OPATCH_CHECK_OH=$2
  241.     OPATCH_CHECK_PATCH=$3
  242.  
  243.     if [[ "$OPATCH_CHECK_COMPONENT" == "ReposDBHome" ]]; then
  244.         OPATCH_RET=`$OPATCH_CHECK_OH/OPatch/opatch lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  245.     else
  246.         OPATCH_RET=`$OPATCH lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  247.     fi
  248.  
  249.     if [[ -z "$OPATCH_RET" ]]; then
  250.         echo FAILED
  251.         FAIL_COUNT=$((FAIL_COUNT+1))
  252.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCH_CHECK_COMPONENT @ ${OPATCH_CHECK_OH}:Patch $OPATCH_CHECK_PATCH not found"
  253.     else
  254.         echo OK
  255.     fi
  256.  
  257.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCH_RET
  258.  
  259. }
  260.  
  261. opatchautocheck () {
  262.     OPATCHAUTO_CHECK_COMPONENT=$1
  263.     OPATCHAUTO_CHECK_OH=$2
  264.     OPATCHAUTO_CHECK_PATCH=$3
  265.  
  266.     OPATCHAUTO_RET=`$OPATCHAUTO lspatches -oh $OPATCHAUTO_CHECK_OH | $GREP $OPATCHAUTO_CHECK_PATCH`
  267.  
  268.     if [[ -z "$OPATCHAUTO_RET" ]]; then
  269.         echo FAILED
  270.         FAIL_COUNT=$((FAIL_COUNT+1))
  271.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCHAUTO_CHECK_COMPONENT @ ${OPATCHAUTO_CHECK_OH}:Patch $OPATCHAUTO_CHECK_PATCH not found"
  272.     else
  273.         echo OK
  274.     fi
  275.  
  276.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCHAUTO_RET
  277.  
  278. }
  279.  
  280. omspatchercheck () {
  281.     OMSPATCHER_CHECK_COMPONENT=$1
  282.     OMSPATCHER_CHECK_OH=$2
  283.     OMSPATCHER_CHECK_PATCH=$3
  284.  
  285.     OMSPATCHER_RET=`$OMSPATCHER lspatches -oh $OMSPATCHER_CHECK_OH | $GREP $OMSPATCHER_CHECK_PATCH`
  286.  
  287.     if [[ -z "$OMSPATCHER_RET" ]]; then
  288.         echo FAILED
  289.         FAIL_COUNT=$((FAIL_COUNT+1))
  290.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OMSPATCHER_CHECK_COMPONENT @ ${OMSPATCHER_CHECK_OH}:Patch $OMSPATCHER_CHECK_PATCH not found"
  291.     else
  292.         echo OK
  293.     fi
  294.  
  295.     test $VERBOSE_CHECKSEC -ge 2 && echo $OMSPATCHER_RET
  296.  
  297. }
  298.  
  299. certcheck () {
  300.     CERTCHECK_CHECK_COMPONENT=$1
  301.     CERTCHECK_CHECK_HOST=$2
  302.     CERTCHECK_CHECK_PORT=$3
  303.  
  304.     echo -ne "\tChecking certificate at $CERTCHECK_CHECK_COMPONENT ($CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT)... "
  305.  
  306.     OPENSSL_SELFSIGNED_COUNT=`echo Q | $OPENSSL s_client -prexit -connect $CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT -tls1 2>&1 | $GREP -ci "self signed certificate"`
  307.  
  308.     if [[ $OPENSSL_SELFSIGNED_COUNT -eq "0" ]]; then
  309.         echo OK
  310.     else
  311.         echo FAILED - Found self-signed certificate
  312.         FAIL_COUNT=$((FAIL_COUNT+1))
  313.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$CERTCHECK_CHECK_COMPONENT @ ${CERTCHECK_CHECK_HOST}:${CERTCHECK_CHECK_PORT} found self-signed certificate"
  314.     fi
  315. }
  316.  
  317. democertcheck () {
  318.     DEMOCERTCHECK_CHECK_COMPONENT=$1
  319.     DEMOCERTCHECK_CHECK_HOST=$2
  320.     DEMOCERTCHECK_CHECK_PORT=$3
  321.  
  322.     echo -ne "\tChecking demo certificate at $DEMOCERTCHECK_CHECK_COMPONENT ($DEMOCERTCHECK_CHECK_HOST:$DEMOCERTCHECK_CHECK_PORT)... "
  323.  
  324.     OPENSSL_DEMO_COUNT=`echo Q | $OPENSSL s_client -prexit -connect $DEMOCERTCHECK_CHECK_HOST:$DEMOCERTCHECK_CHECK_PORT -tls1 2>&1 | $GREP -ci "issuer=/C=US/ST=MyState/L=MyTown/O=MyOrganization/OU=FOR TESTING ONLY/CN"`
  325.  
  326.     if [[ $OPENSSL_DEMO_COUNT -eq "0" ]]; then
  327.         echo OK
  328.     else
  329.         echo FAILED - Found demonstration certificate
  330.         FAIL_COUNT=$((FAIL_COUNT+1))
  331.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$DEMOCERTCHECK_CHECK_COMPONENT @ ${DEMOCERTCHECK_CHECK_HOST}:${DEMOCERTCHECK_CHECK_PORT} found demonstration certificate"
  332.     fi
  333. }
  334.  
  335.  
  336. ciphercheck () {
  337.     OPENSSL_CHECK_COMPONENT=$1
  338.     OPENSSL_CHECK_HOST=$2
  339.     OPENSSL_CHECK_PORT=$3
  340.  
  341.     echo -ne "\tChecking LOW strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  342.  
  343.     OPENSSL_LOW_RETURN=`echo Q | $OPENSSL s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher LOW 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  344.  
  345.     if [[ $OPENSSL_LOW_RETURN -eq "0" ]]; then
  346.         echo -e "\tFAILED - PERMITS LOW STRENGTH CIPHER CONNECTIONS"
  347.         FAIL_COUNT=$((FAIL_COUNT+1))
  348.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits LOW strength ciphers"
  349.     else
  350.         echo -e "\tOK"
  351.     fi
  352.  
  353.  
  354.     echo -ne "\tChecking MEDIUM strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  355.  
  356.     OPENSSL_MEDIUM_RETURN=`echo Q | $OPENSSL s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher MEDIUM 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  357.  
  358.     if [[ $OPENSSL_MEDIUM_RETURN -eq "0" ]]; then
  359.         echo -e "\tFAILED - PERMITS MEDIUM STRENGTH CIPHER CONNECTIONS"
  360.         FAIL_COUNT=$((FAIL_COUNT+1))
  361.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits MEDIUM strength ciphers"
  362.     else
  363.         echo -e "\tOK"
  364.     fi
  365.  
  366.  
  367.  
  368.     echo -ne "\tChecking HIGH strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  369.  
  370.     OPENSSL_HIGH_RETURN=`echo Q | $OPENSSL s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher HIGH 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  371.  
  372.     if [[ $OPENSSL_HIGH_RETURN -eq "0" ]]; then
  373.         echo -e "\tOK"
  374.     else
  375.         echo -e "\tFAILED - CANNOT CONNECT WITH HIGH STRENGTH CIPHER"
  376.         FAIL_COUNT=$((FAIL_COUNT+1))
  377.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Rejects HIGH strength ciphers"
  378.     fi
  379.     echo
  380. }
  381.  
  382. wlspatchcheck () {
  383.     WLSDIR=$1
  384.     WLSPATCH=$2
  385.  
  386.     WLSCHECK_RETURN=`( cd $MW_HOME/utils/bsu && $MW_HOME/utils/bsu/bsu.sh -report ) | $GREP $WLSPATCH`
  387.     WLSCHECK_COUNT=`echo $WLSCHECK_RETURN | wc -l`
  388.  
  389.     if [[ $WLSCHECK_COUNT -ge "1" ]]; then
  390.         echo -e "\tOK"
  391.     else
  392.         echo -e "\tFAILED - PATCH NOT FOUND"
  393.         FAIL_COUNT=$((FAIL_COUNT+1))
  394.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WLSDIR:Patch $WLSPATCH not found"
  395.     fi
  396.  
  397.     test $VERBOSE_CHECKSEC -ge 2 && echo $WLSCHECK_RETURN
  398.    
  399. }
  400.  
  401. javacheck () {
  402.     WHICH_JAVA=$1
  403.     JAVA_DIR=$2
  404.  
  405.     JAVACHECK_RETURN=`$JAVA_DIR/bin/java -version 2>&1 | $GREP version | awk '{print $3}' | sed -e 's/"//g'`
  406.  
  407.     if [[ "$JAVACHECK_RETURN" == "1.7.0_111" ]]; then
  408.         echo -e "\tOK"
  409.     else
  410.         #echo -e "\tFAILED - Found version $JAVACHECK_RETURN"
  411.         echo -e "\tFAILED"
  412.         FAIL_COUNT=$((FAIL_COUNT+1))
  413.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_JAVA Java in ${JAVA_DIR}:Found incorrect version $JAVACHECK_RETURN"
  414.     fi
  415.     test $VERBOSE_CHECKSEC -ge 2 && echo $JAVACHECK_RETURN
  416. }
  417.  
  418. paramcheck () {
  419.     WHICH_PARAM=$1
  420.     WHICH_ORACLE_HOME=$2
  421.     WHICH_FILE=$3
  422.  
  423.     PARAMCHECK_PARAM_FOUND=`$GREP $WHICH_PARAM $WHICH_ORACLE_HOME/network/admin/$WHICH_FILE | $GREP -v '^#' | wc -l`
  424.  
  425.     if [[ $PARAMCHECK_PARAM_FOUND == "0" ]]; then
  426.         FAIL_COUNT=$((FAIL_COUNT+1))
  427.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:parameter not found"
  428.         return
  429.     fi
  430.  
  431.     PARAMCHECK_RETURN=`$GREP $WHICH_PARAM $WHICH_ORACLE_HOME/network/admin/$WHICH_FILE | $GREP -v '^#'  | awk -F= '{print $2}' | sed -e 's/\s//g'`
  432.     if [[ "$WHICH_PARAM" == "SSL_VERSION" ]]; then
  433.         if [[ "$PARAMCHECK_RETURN" == "1.0" ]]; then
  434.             echo -e "OK"
  435.         else
  436.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  437.             FAIL_COUNT=$((FAIL_COUNT+1))
  438.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  439.         fi
  440.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  441.     fi
  442.  
  443.     if [[ "$WHICH_PARAM" == "SSL_CIPHER_SUITES" ]]; then
  444.         if [[ "$PARAMCHECK_RETURN" == "(SSL_RSA_WITH_AES_128_CBC_SHA,SSL_RSA_WITH_AES_256_CBC_SHA)" ]]; then
  445.             echo -e "OK"
  446.         else
  447.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  448.             FAIL_COUNT=$((FAIL_COUNT+1))
  449.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  450.         fi
  451.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  452.     fi
  453.  
  454.     if [[ "$WHICH_PARAM" == "SQLNET.ENCRYPTION_SERVER" ]]; then
  455.         echo $PARAMCHECK_RETURN | $GREP -iE '(requested|required)' >& /dev/null
  456.         PARAM_STATE=$?
  457.  
  458.         if [[ $PARAM_STATE == "0" ]]; then
  459.             echo -e "OK"
  460.         else
  461.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  462.             FAIL_COUNT=$((FAIL_COUNT+1))
  463.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  464.         fi
  465.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  466.     fi
  467.  
  468.     if [[ "$WHICH_PARAM" == "SQLNET.ENCRYPTION_CLIENT" ]]; then
  469.         echo $PARAMCHECK_RETURN | $GREP -iE '(requested|required)' >& /dev/null
  470.         PARAM_STATE=$?
  471.  
  472.         if [[ $PARAM_STATE == "0" ]]; then
  473.             echo -e "OK"
  474.         else
  475.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  476.             FAIL_COUNT=$((FAIL_COUNT+1))
  477.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  478.         fi
  479.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  480.     fi
  481.  
  482.     if [[ "$WHICH_PARAM" == "SQLNET.CRYPTO_CHECKSUM_SERVER" ]]; then
  483.         echo $PARAMCHECK_RETURN | $GREP -iE '(requested|required)' >& /dev/null
  484.         PARAM_STATE=$?
  485.  
  486.         if [[ $PARAM_STATE == "0" ]]; then
  487.             echo -e "OK"
  488.         else
  489.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  490.             FAIL_COUNT=$((FAIL_COUNT+1))
  491.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  492.         fi
  493.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  494.     fi
  495.  
  496.     if [[ "$WHICH_PARAM" == "SQLNET.CRYPTO_CHECKSUM_CLIENT" ]]; then
  497.         echo $PARAMCHECK_RETURN | $GREP -iE '(requested|required)' >& /dev/null
  498.         PARAM_STATE=$?
  499.  
  500.         if [[ $PARAM_STATE == "0" ]]; then
  501.             echo -e "OK"
  502.         else
  503.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  504.             FAIL_COUNT=$((FAIL_COUNT+1))
  505.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  506.         fi
  507.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  508.     fi
  509.  
  510.     if [[ "$WHICH_PARAM" == "SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER" ]]; then
  511.         echo $PARAMCHECK_RETURN | $GREP -iE 'MD5' >& /dev/null
  512.         PARAM_STATE=$?
  513.  
  514.         if [[ $PARAM_STATE == "1" ]]; then
  515.             echo -e "OK"
  516.         else
  517.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  518.             FAIL_COUNT=$((FAIL_COUNT+1))
  519.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value (do not use MD5, only use SHA1 and/or SHA256)"
  520.         fi
  521.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  522.     fi
  523.  
  524.     if [[ "$WHICH_PARAM" == "SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT" ]]; then
  525.         echo $PARAMCHECK_RETURN | $GREP -iE 'MD5' >& /dev/null
  526.         PARAM_STATE=$?
  527.  
  528.         if [[ $PARAM_STATE == "1" ]]; then
  529.             echo -e "OK"
  530.         else
  531.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  532.             FAIL_COUNT=$((FAIL_COUNT+1))
  533.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value (do not use MD5, only use SHA1 and/or SHA256)"
  534.         fi
  535.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  536.     fi
  537.  
  538.     if [[ "$WHICH_PARAM" == "SQLNET.ENCRYPTION_TYPES_SERVER" ]]; then
  539.         echo $PARAMCHECK_RETURN | $GREP -iE '([(,]des[),]|3des112|rc4|des40)' >& /dev/null
  540.         PARAM_STATE=$?
  541.  
  542.         if [[ $PARAM_STATE == "1" ]]; then
  543.             echo -e "OK"
  544.         else
  545.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  546.             FAIL_COUNT=$((FAIL_COUNT+1))
  547.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value (do not use DES, DES40, RC4_40, RC4_56, RC4_128, RC4_256, or 3DES112)"
  548.         fi
  549.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  550.     fi
  551.  
  552.     if [[ "$WHICH_PARAM" == "SQLNET.ENCRYPTION_TYPES_CLIENT" ]]; then
  553.         echo $PARAMCHECK_RETURN | $GREP -iE '([(,]des[),]|3des112|rc4|des40)' >& /dev/null
  554.         PARAM_STATE=$?
  555.  
  556.         if [[ $PARAM_STATE == "1" ]]; then
  557.             echo -e "OK"
  558.         else
  559.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  560.             FAIL_COUNT=$((FAIL_COUNT+1))
  561.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value (do not use DES, DES40, RC4_40, RC4_56, RC4_128, RC4_256, or 3DES112)"
  562.         fi
  563.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  564.     fi
  565. }
  566.  
  567.  
  568. ### MAIN SCRIPT HERE
  569.  
  570.  
  571. echo -e "Performing EM13c security checkup version $VERSION on $OMSHOST at `date`.\n"
  572.  
  573. echo "Using port definitions from configuration files "
  574. echo -e "\t/etc/oragchomelist"
  575. echo -e "\t$EMGC_PROPS"
  576. echo -e "\t$EMBIP_PROPS"
  577. echo
  578. echo -e "\tAgent port found at $OMSHOST:$PORT_AGENT"
  579. echo -e "\tBIPublisher port found at $OMSHOST:$PORT_BIP"
  580. echo -e "\tBIPublisherOHS port found at $OMSHOST:$PORT_BIP_OHS"
  581. echo -e "\tNodeManager port found at $OMSHOST:$PORT_NODEMANAGER"
  582. echo -e "\tOMSconsole port found at $OMSHOST:$PORT_OMS"
  583. echo -e "\tOMSproxy port found at $OMSHOST:$PORT_OMS_JAVA"
  584. echo -e "\tOMSupload port found at $OMSHOST:$PORT_UPL"
  585. echo -e "\tWLSadmin found at $OMSHOST:$PORT_ADMINSERVER"
  586. echo
  587. echo -e "\tRepository DB version=$REPOS_DB_VERSION SID=$REPOS_DB_SID host=$REPOS_DB_HOST"
  588.  
  589. if [[ $RUN_DB_CHECK -eq "1" ]]; then
  590.     echo -e "\tRepository DB on OMS server, will check patches/parameters in $REPOS_DB_HOME"
  591. fi
  592.  
  593. echo -e "\n(1) Checking SSL/TLS configuration (see notes 1602983.1, 1477287.1, 1905314.1)"
  594.  
  595. echo -e "\n\t(1a) Forbid SSLv2 connections"
  596. sslcheck Agent $OMSHOST $PORT_AGENT ssl2
  597. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl2
  598. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl2
  599. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS ssl2
  600. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl2
  601. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl2
  602. sslcheck OMSupload $OMSHOST $PORT_UPL ssl2
  603. #sslcheck OPMN $OMSHOST $PORT_OPMN ssl2
  604. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl2
  605.  
  606. echo -e "\n\t(1b) Forbid SSLv3 connections"
  607. sslcheck Agent $OMSHOST $PORT_AGENT ssl3
  608. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl3
  609. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl3
  610. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS ssl3
  611. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl3
  612. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl3
  613. sslcheck OMSupload $OMSHOST $PORT_UPL ssl3
  614. #sslcheck OPMN $OMSHOST $PORT_OPMN ssl3
  615. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl3
  616.  
  617. echo -e "\n\t(1c) $OPENSSL_PERMIT_FORBID_NON_TLS1_2 TLSv1 connections"
  618. sslcheck Agent $OMSHOST $PORT_AGENT tls1
  619. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1
  620. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1
  621. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS tls1
  622. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1
  623. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1
  624. sslcheck OMSupload $OMSHOST $PORT_UPL tls1
  625. #sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  626. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1
  627.  
  628. echo -e "\n\t(1c) $OPENSSL_PERMIT_FORBID_NON_TLS1_2 TLSv1.1 connections"
  629. sslcheck Agent $OMSHOST $PORT_AGENT tls1_1
  630. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1_1
  631. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1_1
  632. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS tls1_1
  633. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1_1
  634. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1_1
  635. sslcheck OMSupload $OMSHOST $PORT_UPL tls1_1
  636. #sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  637. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1_1
  638.  
  639. echo -e "\n\t(1c) Permit TLSv1.2 connections"
  640. sslcheck Agent $OMSHOST $PORT_AGENT tls1_2
  641. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1_2
  642. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1_2
  643. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS tls1_2
  644. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1_2
  645. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1_2
  646. sslcheck OMSupload $OMSHOST $PORT_UPL tls1_2
  647. #sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  648. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1_2
  649.  
  650. echo -e "\n(2) Checking supported ciphers at SSL/TLS endpoints (see notes 2138391.1, 1067411.1)"
  651. ciphercheck Agent $OMSHOST $PORT_AGENT
  652. ciphercheck BIPublisher $OMSHOST $PORT_BIP
  653. ciphercheck NodeManager $OMSHOST $PORT_NODEMANAGER
  654. ciphercheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS
  655. ciphercheck OMSconsole $OMSHOST $PORT_OMS
  656. ciphercheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  657. ciphercheck OMSupload $OMSHOST $PORT_UPL
  658. #ciphercheck OPMN $OMSHOST $PORT_OPMN
  659. ciphercheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  660.  
  661. echo -e "\n(3) Checking self-signed and demonstration certificates at SSL/TLS endpoints (see notes 1367988.1, 1399293.1, 1593183.1, 1527874.1, 123033.1, 1937457.1)"
  662. certcheck Agent $OMSHOST $PORT_AGENT
  663. democertcheck Agent $OMSHOST $PORT_AGENT
  664. certcheck BIPublisher $OMSHOST $PORT_BIP
  665. democertcheck BIPublisher $OMSHOST $PORT_BIP
  666. certcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  667. democertcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  668. certcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS
  669. democertcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS
  670. certcheck OMSconsole $OMSHOST $PORT_OMS
  671. democertcheck OMSconsole $OMSHOST $PORT_OMS
  672. certcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  673. democertcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  674. certcheck OMSupload $OMSHOST $PORT_UPL
  675. democertcheck OMSupload $OMSHOST $PORT_UPL
  676. #certcheck OPMN $OMSHOST $PORT_OPMN
  677. #democertcheck OPMN $OMSHOST $PORT_OPMN
  678. certcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  679. democertcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  680.  
  681.  
  682. echo -e "\n(4) Checking EM13c Oracle home patch levels against $PATCHDATE baseline (see notes 1664074.1, 1900943.1, 822485.1, 1470197.1, 1967243.1)"
  683.  
  684. if [[ $RUN_DB_CHECK -eq 1 ]]; then
  685.  
  686.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  687.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.160119 (JAN2016) (21948354)... "
  688.         #opatchcheck ReposDBHome $REPOS_DB_HOME 21948354
  689.  
  690.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.160419 (APR2016) (22291127)... "
  691.         #opatchcheck ReposDBHome $REPOS_DB_HOME 22291127
  692.  
  693.         echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.160719 (JUL2016) (23054246)... "
  694.         opatchcheck ReposDBHome $REPOS_DB_HOME 23054246
  695.  
  696.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.160119 DATABASE PSU (JAN2016) (22139226)... "
  697.         #opatchcheck ReposDBHome $REPOS_DB_HOME 22139226
  698.  
  699.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.160419 DATABASE PSU (APR2016) (22674709)... "
  700.         #opatchcheck ReposDBHome $REPOS_DB_HOME 22674709
  701.  
  702.         echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.160719 DATABASE PSU (JUL2016) (23177536)... "
  703.         opatchcheck ReposDBHome $REPOS_DB_HOME 23177536
  704.     fi
  705.  
  706.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.ENCRYPTION_TYPES_SERVER parameter (76629.1, 2167682.1)... "
  707.     paramcheck SQLNET.ENCRYPTION_TYPES_SERVER $REPOS_DB_HOME sqlnet.ora
  708.  
  709.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.ENCRYPTION_SERVER parameter (76629.1, 2167682.1)... "
  710.     paramcheck SQLNET.ENCRYPTION_SERVER $REPOS_DB_HOME sqlnet.ora
  711.  
  712.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.ENCRYPTION_TYPES_CLIENT parameter (76629.1, 2167682.1)... "
  713.     paramcheck SQLNET.ENCRYPTION_TYPES_CLIENT $REPOS_DB_HOME sqlnet.ora
  714.  
  715.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.ENCRYPTION_CLIENT parameter (76629.1, 2167682.1)... "
  716.     paramcheck SQLNET.ENCRYPTION_CLIENT $REPOS_DB_HOME sqlnet.ora
  717.  
  718.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER parameter (76629.1, 2167682.1)... "
  719.     paramcheck SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER $REPOS_DB_HOME sqlnet.ora
  720.  
  721.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.CRYPTO_CHECKSUM_SERVER parameter (76629.1, 2167682.1)... "
  722.     paramcheck SQLNET.CRYPTO_CHECKSUM_SERVER $REPOS_DB_HOME sqlnet.ora
  723.  
  724.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT parameter (76629.1, 2167682.1)... "
  725.     paramcheck SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT $REPOS_DB_HOME sqlnet.ora
  726.  
  727.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.CRYPTO_CHECKSUM_CLIENT parameter (76629.1, 2167682.1)... "
  728.     paramcheck SQLNET.CRYPTO_CHECKSUM_CLIENT $REPOS_DB_HOME sqlnet.ora
  729.  
  730.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_VERSION parameter (1545816.1)... "
  731.     paramcheck SSL_VERSION $REPOS_DB_HOME sqlnet.ora
  732.  
  733.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  734.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME sqlnet.ora
  735.  
  736.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_VERSION parameter (1545816.1)... "
  737.     paramcheck SSL_VERSION $REPOS_DB_HOME listener.ora
  738.  
  739.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  740.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME listener.ora
  741. fi
  742.  
  743. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160331 (22823268)... "
  744. #opatchcheck Agent $AGENT_HOME 22823268
  745.  
  746. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160429 (23030165)... "
  747. #opatchcheck Agent $AGENT_HOME 23030165
  748.  
  749. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160531 (23208577)... "
  750. #opatchcheck Agent $AGENT_HOME 23208577
  751.  
  752. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160719 (23592254)... "
  753. #opatchcheck Agent $AGENT_HOME 23592254
  754.  
  755. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160816 (24308442)... "
  756. opatchcheck Agent $AGENT_HOME 24308442
  757.  
  758. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160331 MONITORING (22920712)... "
  759. #opatchcheck Agent $AGENT_HOME 22920712
  760.  
  761. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160429 MONITORING (23095221)... "
  762. #opatchcheck Agent $AGENT_HOME 23095221
  763.  
  764. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160531 MONITORING (23294830)... "
  765. #opatchcheck Agent $AGENT_HOME 23294830
  766.  
  767. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160719 MONITORING (23697777)... "
  768. #opatchcheck Agent $AGENT_HOME 23697777
  769.  
  770. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160816 MONITORING (24364560)... "
  771. opatchcheck Agent $AGENT_HOME 24364560
  772.  
  773. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160531 DISCOVERY (23294839)... "
  774. opatchcheck Agent $AGENT_HOME 23294839
  775.  
  776. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160331 MONITORING (22936491)... "
  777. #opatchcheck Agent $AGENT_HOME 22936491
  778.  
  779. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160429 MONITORING (23095280)... "
  780. #opatchcheck Agent $AGENT_HOME 23095280
  781.  
  782. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160531 MONITORING (23294872)... "
  783. #opatchcheck Agent $AGENT_HOME 23294872
  784.  
  785. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160719 MONITORING (23697781)... "
  786. opatchcheck Agent $AGENT_HOME 23697781
  787.  
  788. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160331 MONITORING (22823189)... "
  789. #opatchcheck Agent $AGENT_HOME 22823189
  790.  
  791. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160531 MONITORING (23208587)... "
  792. #opatchcheck Agent $AGENT_HOME 23208587
  793.  
  794. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160719 MONITORING (23697783)... "
  795. opatchcheck Agent $AGENT_HOME 23697783
  796.  
  797. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160531 DISCOVERY (23294895)... "
  798. opatchcheck Agent $AGENT_HOME 23294895
  799.  
  800. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160331 (22920724)... "
  801. #omspatchercheck OMS $OMS_HOME 22920724
  802.  
  803. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM OH PLUGIN BUNDLE PATCH 13.1.1.0.160429 (23135564)... "
  804. opatchcheck Agent $AGENT_HOME 23135564
  805.  
  806. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160429 (23095307)... "
  807. #omspatchercheck OMS $OMS_HOME 23095307
  808.  
  809. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160531 (23294904)... "
  810. #omspatchercheck OMS $OMS_HOME 23294904
  811.  
  812. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160719 (23697785)... "
  813. #omspatchercheck OMS $OMS_HOME 23697785
  814.  
  815. echo -ne "\n\t(4d) *UPDATED* OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160816 (24364619)... "
  816. omspatchercheck OMS $OMS_HOME 24364619
  817.  
  818. #echo -ne "\n\t(4e) ($MW_HOME) WLS PATCH SET UPDATE 12.1.3.0.160419 (22505404)... "
  819. #opatchcheck WLS $MW_HOME 22505404
  820.  
  821. echo -ne "\n\t(4d) ($MW_HOME) WLS PATCH SET UPDATE 12.1.3.0.160719 (23094292)... "
  822. opatchcheck WLS $MW_HOME 23094292
  823.  
  824. echo -ne "\n\t(4f) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER BASE PLATFORM PATCH SET UPDATE 13.1.0.0.160719 (23134365)... "
  825. omspatchercheck OMS $MW_HOME 23134365
  826.  
  827. echo -e "\n(5) Checking EM13c Java patch levels against $PATCHDATE baseline (see notes 1492980.1, 1616397.1)"
  828.  
  829. echo -ne "\n\t(5a) WLS ($MW_HOME/oracle_common/jdk) JAVA SE JDK VERSION 1.7.0-111 (13079846)... "
  830. javacheck WLSJAVA $MW_HOME/oracle_common/jdk
  831.  
  832. #echo -ne "\n\t(5a) *NEW* OMS CHAINED AGENT HOME ($AGENT_HOME/oracle_common/jdk) JAVA SE JDK VERSION 1.7.0-111 (13079846)... "
  833. #javacheck AGTJAVA $AGENT_HOME/oracle_common/jdk
  834.  
  835. echo
  836. echo
  837.  
  838. if [[ $FAIL_COUNT -gt "0" ]]; then
  839.     echo "Failed test count: $FAIL_COUNT - Review output"
  840.     test $VERBOSE_CHECKSEC -ge 1 && echo -e $FAIL_TESTS
  841. else
  842.     echo "All tests succeeded."
  843. fi
  844.  
  845. echo
  846. echo "Visit https://pardydba.wordpress.com/2016/04/05/securing-oracle-enterprise-manager-13c/ for the latest version."
  847. echo
  848.  
  849. exit
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!